| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Habe versehentlich ein Videocodec angenommen, Virusbefall!!!Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
30.06.2008, 11:31
| #1 |
 |  Habe versehentlich ein Videocodec angenommen, Virusbefall!!! Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:26:52, on 30.06.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 SP2 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\IoctlSvc.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\system32\svchost.exe C:\Programme\VIA\RAID\raid_tool.exe C:\Programme\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Gemeinsame Dateien\BitDefender\BitDefender Communicator\xcommsvr.exe C:\Programme\BitDefender\BitDefender 2008\bdagent.exe C:\Programme\BitDefender\BitDefender 2008\vsserv.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Mozilla Firefox\firefox.exe C:\Programme\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = h**p://internetsearchservice.com R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = h**p://internetsearchservice.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://internetsearchservice.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = h**p://internetsearchservice.com/ie6.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://internetsearchservice.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.restorehomesite.com/?cm=440539<=2&it=2008-06-30%2002%3A44%3A52&dt=2008-06-30%2003%3A23%3A00&q=http://w*w.olb.de/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = h**p://internetsearchservice.com R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: 788877 helper - {7BC9C2E2-73A6-4FCF-B73D-CBAA20B31C9B} - C:\WINDOWS\system32\788877\788877.dll O2 - BHO: WarningBHO Class - {9989F1F6-70DE-4244-AC9F-6672983681A0} - C:\Programme\AntiSpyCheck 2.1\IEWarning32.dll (file missing) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O2 - BHO: (no name) - {B8301AF7-D00E-4EA4-87C1-5FF4644FBBA1} - C:\Programme\Web Technologies\iebt.dll (file missing) O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Programme\BitDefender\BitDefender 2008\IEToolbar.dll O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [RaidTool] C:\Programme\VIA\RAID\raid_tool.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Programme\Lexmark X74-X75\lxbbbmgr.exe" O4 - HKLM\..\Run: [NBKeyScan] "C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [AntiSpyCheck 2.1] "C:\Programme\AntiSpyCheck 2.1\AntiSpyCheck 2.1.exe" O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Programme\BitDefender\BitDefender 2008\IEShow.exe" O4 - HKLM\..\Run: [BDAgent] "C:\Programme\BitDefender\BitDefender 2008\bdagent.exe" O4 - HKLM\..\RunOnce: [IERESETATTRIB] %SystemRoot%\system32\cmd.exe /d /q /c %SystemRoot%\system32\ieudinit.exe -ResetFileAttributes O4 - HKLM\..\RunOnce: [IERESETICONS] %SystemRoot%\system32\cmd.exe /d /q /c %SystemRoot%\iereseticons.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Programme\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [AUTORUN_VAL] C:\Programme\AntiSpyCheck 2.1\AntiSpyCheck 2.1.exe O4 - HKLM\..\Policies\Explorer\Run: [start] C:\Programme\Web Technologies\iebtm.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Save.TV.lnk = C:\Dokumente und Einstellungen\******\Lokale Einstellungen\Apps\2.0\9X9GEK3H.TK5\ZTXPJLDZ.8VQ\stvs..tion_ccc3f317332ac6c5_0001.0000_0fba58418a10c9b9\stvSatelliteApp.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Programme\PokerStars\PokerStarsUpdate.exe O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - h**p://w*w.iexplorergate.com/redirect.php (file missing) O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - h**p://w*w.iexplorergate.com/redirect.php (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O16 - DPF: {271A3CF5-5A54-447B-A08F-BE805F0DA60B} (DataDesign DDBAC Plug-In) - h**ps://w*w.olb.de/olb_fb3_1818/plugin/AXFOAM.CAB O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programme\Yahoo!\Common\yinsthelper.dll O22 - SharedTaskScheduler: dysmenorrhoea - {2a7a8ce2-1eaf-4fc0-9158-958bb6bfa5c4} - (no file) O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Programme\Gemeinsame Dateien\BitDefender\BitDefender Update Service\livesrv.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Programme\BitDefender\BitDefender 2008\vsserv.exe O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Programme\Gemeinsame Dateien\BitDefender\BitDefender Communicator\xcommsvr.exe -- End of file - 8238 bytes
__________________  Der schlimmste Virus ist der Mensch Ich dachte Trojaner haben was mit Sparta zu tun |
|
30.06.2008, 11:54
| #2 |
| /// AVZ-Toolkit Guru   | Habe versehentlich ein Videocodec angenommen, Virusbefall!!! Hallo Putzi.
__________________Bitte beschreibe dein Problem noch etwas genauer. Pfadangaben, logs und Meldungen sind hier gefordert. Folge dieser Anleitung: SmitFraudFix und poste das log.
__________________ |
|
30.06.2008, 12:17
| #3 |
| | Habe versehentlich ein Videocodec angenommen, Virusbefall!!! SmitFraudFix v2.328 Searchergebnis
__________________Scan done at 13:13:34,43, 30.06.2008 Run from C:\Dokumente und Einstellungen\******\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\IoctlSvc.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\system32\svchost.exe C:\Programme\VIA\RAID\raid_tool.exe C:\Programme\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Gemeinsame Dateien\BitDefender\BitDefender Communicator\xcommsvr.exe C:\Programme\BitDefender\BitDefender 2008\bdagent.exe C:\Programme\BitDefender\BitDefender 2008\vsserv.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\cmd.exe C:\WINDOWS\explorer.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Dokumente und Einstellungen\****** »»»»»»»»»»»»»»»»»»»»»»»» C:\Dokumente und Einstellungen\*****\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOKUME~1\*****~1\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Programme »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components »»»»»»»»»»»»»»»»»»»»»»»» IEDFix !!!Attention, following keys are not inevitably infected!!! IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» VACFix !!!Attention, following keys are not inevitably infected!!! VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix !!!Attention, following keys are not inevitably infected!!! 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{2a7a8ce2-1eaf-4fc0-9158-958bb6bfa5c4}"="dysmenorrhoea" »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"="C:\\WINDOWS\\system32\\userinit.exe," "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Rustock »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: Realtek RTL8169/8110 Family Gigabit Ethernet NIC - Paketplaner-Miniport DNS Server Search Order: 83.169.186.161 DNS Server Search Order: 192.168.0.1 HKLM\SYSTEM\CCS\Services\Tcpip\..\{7F4846B2-6FB6-412E-88C3-5781245FDEC6}: DhcpNameServer=83.169.186.161 192.168.0.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{7F4846B2-6FB6-412E-88C3-5781245FDEC6}: DhcpNameServer=83.169.186.161 192.168.0.1 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=83.169.186.161 192.168.0.1 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=83.169.186.161 192.168.0.1 »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End Java-Programme gelöscht Blacklight ohne Befund
__________________ Geändert von Putzi79 (30.06.2008 um 12:29 Uhr) |
|
01.07.2008, 02:42
| #4 |
| | Habe versehentlich ein Videocodec angenommen, Virusbefall!!! "Silent Runners.vbs", revision 58, h**p:/****.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "LightScribe Control Panel" = "C:\Programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe -hidden" [file not found] "AlcoholAutomount" = ""C:\Programme\Alcohol Soft\Alcohol 120\axcmd.exe" /automount" ["Alcohol Soft Development Team"] "SUPERAntiSpyware" = "C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe" ["SUPERAntiSpyware.com"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "High Definition Audio Property Page Shortcut" = "HDAShCut.exe" ["Windows (R) Server 2003 DDK provider"] "RaidTool" = "C:\Programme\VIA\RAID\raid_tool.exe" ["VIA Technologies"] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "SynTPLpr" = "C:\Programme\Synaptics\SynTP\SynTPLpr.exe" ["Synaptics, Inc."] "SynTPEnh" = "C:\Programme\Synaptics\SynTP\SynTPEnh.exe" ["Synaptics, Inc."] "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "AlcWzrd" = "ALCWZRD.EXE" ["RealTek Semicoductor Corp."] "Alcmtr" = "ALCMTR.EXE" ["Realtek Semiconductor Corp."] "BluetoothAuthenticationAgent" = "rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent" [MS] "Lexmark X74-X75" = ""C:\Programme\Lexmark X74-X75\lxbbbmgr.exe"" ["Lexmark International, Inc."] "NBKeyScan" = ""C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"" [file not found] "BitDefender Antiphishing Helper" = ""C:\Programme\BitDefender\BitDefender 2008\IEShow.exe"" ["BitDefender"] "BDAgent" = ""C:\Programme\BitDefender\BitDefender 2008\bdagent.exe"" ["BitDefender S.R.L."] HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\ <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}\(Default) = "IE7 Uninstall Stub" \StubPath = "C:\WINDOWS\system32\ieudinit.exe" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {02478D38-C3F9-4EFB-9B51-7695ECA05670}\(Default) = (no title provided) -> {HKLM...CLSID} = "Yahoo! Toolbar Helper" \InProcServer32\(Default) = "C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader" \InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Helper" \InProcServer32\(Default) = "c:\programme\google\googletoolbar1.dll" ["Google Germany GmbH"] {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Notifier BHO" \InProcServer32\(Default) = "C:\Programme\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll" ["Google Inc."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung" -> {HKLM...CLSID} = "CPL-Erweiterung für Anzeigeverschiebung" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{2F603045-309F-11CF-9774-0020AFD0CFF6}" = "Synaptics Control Panel" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Programme\Synaptics\SynTP\SynTPCpl.dll" ["Synaptics, Inc."] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data] "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Programme\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Programme\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice.org Property Sheet Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Programme\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Programme\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}" = "TuneUp Shredder Shell Extension" -> {HKLM...CLSID} = "TuneUp Shredder Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\TUNEUP~1\SDShelEx-win32.dll" ["TuneUp Software GmbH"] "{44440D00-FF19-4AFC-B765-9A0970567D97}" = "TuneUp Theme Extension" -> {HKLM...CLSID} = "TuneUp Theme Extension" \InProcServer32\(Default) = "C:\WINDOWS\System32\uxtuneup.dll" ["TuneUp Software GmbH"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}" = (no title provided) -> {HKLM...CLSID} = "SABShellExecuteHook Class" \InProcServer32\(Default) = "C:\Programme\SUPERAntiSpyware\SASSEH.DLL" ["SuperAdBlocker.com"] HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\ <<!>> ("" [file not found]) "SecurityProviders" = "msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll," HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> !SASWinLogon\DLLName = "C:\Programme\SUPERAntiSpyware\SASWINLO.dll" ["SUPERAntiSpyware.com"] HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\ {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\(Default) = "OpenOffice.org Column Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Programme\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ TuneUp Shredder Shell Extension\(Default) = "{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}" -> {HKLM...CLSID} = "TuneUp Shredder Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\TUNEUP~1\SDShelEx-win32.dll" ["TuneUp Software GmbH"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ TuneUp Shredder Shell Extension\(Default) = "{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}" -> {HKLM...CLSID} = "TuneUp Shredder Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\TUNEUP~1\SDShelEx-win32.dll" ["TuneUp Software GmbH"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ MBAMShlExt\(Default) = "{57CE581A-0CB6-4266-9CA0-19364C90A0B3}" -> {HKLM...CLSID} = "MBAMShlExt Class" \InProcServer32\(Default) = "C:\Programme\Malwarebytes' Anti-Malware\mbamext.dll" ["Malwarebytes"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ MBAMShlExt\(Default) = "{57CE581A-0CB6-4266-9CA0-19364C90A0B3}" -> {HKLM...CLSID} = "MBAMShlExt Class" \InProcServer32\(Default) = "C:\Programme\Malwarebytes' Anti-Malware\mbamext.dll" ["Malwarebytes"] Default executables: -------------------- HKLM\SOFTWARE\Classes\.scr\(Default) = "scrfile" <<!>> HKLM\SOFTWARE\Classes\scrfile\shell\open\command\(Default) = ""%1" %*" [file not found] Group Policies {policy setting}: -------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLogoffScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "RunLogonScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "RunStartupScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "HideStartupScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001 {Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) dword:0x00000001 {Devices: Allow undock without having to log on} "HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLogoffScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "RunLogonScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "RunStartupScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "HideStartupScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp" Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ AlcoholAutoPlayV2.BurnDisc\ "Provider" = "Alcohol 120%" "InvokeProgID" = "AlcoholAutoPlayV2" "InvokeVerb" = "BurnDisc" HKLM\SOFTWARE\Classes\AlcoholAutoPlayV2\shell\BurnDisc\command\(Default) = ""C:\Programme\Alcohol Soft\Alcohol 120\Alcohol.exe" %1" ["Alcohol Soft Development Team"] AlcoholAutoPlayV2.ReadDisc\ "Provider" = "Alcohol 120%" "InvokeProgID" = "AlcoholAutoPlayV2" "InvokeVerb" = "BurnDisc" HKLM\SOFTWARE\Classes\AlcoholAutoPlayV2\shell\BurnDisc\command\(Default) = ""C:\Programme\Alcohol Soft\Alcohol 120\Alcohol.exe" %1" ["Alcohol Soft Development Team"] ASHAshampoo_Burning_Studio_6BURNONARRIVAL\ "Provider" = "Ashampoo Burning Studio 6" "InvokeProgID" = "Ashampoo.BurningStudio6" "InvokeVerb" = "autoplay-burn" HKLM\SOFTWARE\Classes\Ashampoo.BurningStudio6\shell\autoplay-burn\Command\(Default) = ""C:\Programme\Ashampoo\Ashampoo Burning Studio 6\burningstudio.exe" -autoplay -selectdrive "%l"" ["ashampoo Technology GmbH & Co. KG"] ASHAshampoo_Burning_Studio_6COPYONARRIVAL\ "Provider" = "Ashampoo Burning Studio 6" "InvokeProgID" = "Ashampoo.BurningStudio6" "InvokeVerb" = "autoplay-copy" HKLM\SOFTWARE\Classes\Ashampoo.BurningStudio6\shell\autoplay-copy\Command\(Default) = ""C:\Programme\Ashampoo\Ashampoo Burning Studio 6\burningstudio.exe" -autoplay -selectdrive "%l" -copy" ["ashampoo Technology GmbH & Co. KG"] ASHAshampoo_Burning_Studio_6RIPONARRIVAL\ "Provider" = "Ashampoo Burning Studio 6" "InvokeProgID" = "Ashampoo.BurningStudio6" "InvokeVerb" = "autoplay-rip" HKLM\SOFTWARE\Classes\Ashampoo.BurningStudio6\shell\autoplay-rip\Command\(Default) = ""C:\Programme\Ashampoo\Ashampoo Burning Studio 6\burningstudio.exe" -autoplay -selectdrive "%l" -rip" ["ashampoo Technology GmbH & Co. KG"] ASHAshampoo_Burning_Studio_6_FREEBURNONARRIVAL\ "Provider" = "Ashampoo Burning Studio 6 FREE" "InvokeProgID" = "Ashampoo.BurningStudio6FREE" "InvokeVerb" = "autoplay-burn" HKLM\SOFTWARE\Classes\Ashampoo.BurningStudio6FREE\shell\autoplay-burn\Command\(Default) = ""C:\Programme\Ashampoo\Ashampoo Burning Studio 6\burningstudio.exe" -autoplay -selectdrive "%l"" ["ashampoo Technology GmbH & Co. KG"] ASHAshampoo_Burning_Studio_6_FREECOPYONARRIVAL\ "Provider" = "Ashampoo Burning Studio 6 FREE" "InvokeProgID" = "Ashampoo.BurningStudio6FREE" "InvokeVerb" = "autoplay-copy" HKLM\SOFTWARE\Classes\Ashampoo.BurningStudio6FREE\shell\autoplay-copy\Command\(Default) = "C:\Programme\Ashampoo\Ashampoo Burning Studio 6\burningstudio.exe" -autoplay -selectdrive "%l" -copy" [file not found] ASHAshampoo_Burning_Studio_6_FREERIPONARRIVAL\ "Provider" = "Ashampoo Burning Studio 6 FREE" "InvokeProgID" = "Ashampoo.BurningStudio6FREE" "InvokeVerb" = "autoplay-rip" HKLM\SOFTWARE\Classes\Ashampoo.BurningStudio6FREE\shell\autoplay-rip\Command\(Default) = ""C:\Programme\Ashampoo\Ashampoo Burning Studio 6\burningstudio.exe" -autoplay -selectdrive "%l" -rip" ["ashampoo Technology GmbH & Co. KG"] FunMultiMediaHandler\ "Provider" = "MultiMedia Manager" "ProgID" = "FUNBOX.Autoplay" HKLM\SOFTWARE\Classes\FUNBOX.Autoplay\CLSID\(Default) = "{DF866F1F-10DF-4694-94A9-7F526FC8800A}" -> {HKLM...CLSID} = "FUNBOX Autoplay Sample 2" \LocalServer32\(Default) = "C:\Program Files\Samsung\Samsung PC Studio 3\Share_autoplay.exe" [file not found] MPCPlayCDAudioOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayCDAudio" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayCDAudio\command\(Default) = ""C:\Programme\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /cd" ["Gabest"] MPCPlayDVDMovieOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayDVDMovie" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayDVDMovie\command\(Default) = ""C:\Programme\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /dvd" ["Gabest"] MPCPlayMusicFilesOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayMusicFiles" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayMusicFiles\command\(Default) = ""C:\Programme\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["Gabest"] MPCPlayVideoFilesOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayVideoFiles" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayVideoFiles\command\(Default) = ""C:\Programme\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["Gabest"] MSVideoCameraArrival\ "Provider" = "@C:\Programme\Movie Maker\1031\wmm2res.dll,-100" "ProgID" = "Shell.HWEventHandlerShellExecute" "InitCmdLine" = ""C:\Programme\Movie Maker\moviemk.exe" /RECORD" HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" -> {HKLM...CLSID} = "ShellExecute HW Event Handler" \LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS] VLCPlayCDAudioOnArrival\ "Provider" = "VideoLAN VLC media player" "InvokeProgID" = "VLC.CDAudio" "InvokeVerb" = "play" HKLM\SOFTWARE\Classes\VLC.CDAudio\shell\play\command\(Default) = "C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file cdda:%1" ["VideoLAN Team"] VLCPlayDVDMovieOnArrival\ "Provider" = "VideoLAN VLC media player" "InvokeProgID" = "VLC.DVDMovie" "InvokeVerb" = "play" HKLM\SOFTWARE\Classes\VLC.DVDMovie\shell\play\command\(Default) = "C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file dvd:%1" ["VideoLAN Team"] WinampMTPHandler\ "Provider" = "Winamp" "ProgID" = "Shell.HWEventHandlerShellExecute" "InitCmdLine" = "C:\Programme\Winamp\winamp.exe" HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" -> {HKLM...CLSID} = "ShellExecute HW Event Handler" \LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS] WinampPlayMediaOnArrival\ "Provider" = "Winamp" "InvokeProgID" = "Winamp.File" "InvokeVerb" = "Play" HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\command\(Default) = ""C:\Programme\Winamp\winamp.exe" "%1"" ["Nullsoft"] HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\DropTarget\CLSID = "{46986115-84D6-459c-8F95-52DD653E532E}" -> {HKLM...CLSID} = (no title provided) \LocalServer32\(Default) = ""C:\Programme\Winamp\winamp.exe"" ["Nullsoft"] Startup items in "*******" & "All Users" startup folders: ------------------------------------------------------------ C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart "Save.TV" -> shortcut to: "C:\Dokumente und Einstellungen\*******\Lokale Einstellungen\Apps\2.0\9X9GEK3H.TK5\ZTXPJLDZ.8VQ\stvs..tion_ccc3f317332ac6c5_0001.0000_0fba58418a10c9b9\stvSatelliteApp.exe" [null data] Enabled Scheduled Tasks: ------------------------ "1-Klick-Wartung" -> launches: "C:\Programme\TuneUp Utilities 2008\OneClickStarter.exe /schedulestart" [null data] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\programme\google\googletoolbar1.dll" ["Google Germany GmbH"] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ "{381FFDE8-2394-4F90-B10D-FC6124A40F8C}" = "IEToolbar" -> {HKLM...CLSID} = "BitDefender Toolbar" \InProcServer32\(Default) = "C:\Programme\BitDefender\BitDefender 2008\IEToolbar.dll" ["Bitdefender"] "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided) -> {HKLM...CLSID} = "Yahoo! Toolbar mit Pop-Up-Blocker" \InProcServer32\(Default) = "C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."] Extensions (Tools menu items, main toolbar menu buttons) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\ {3AD14F0C-ED16-4E43-B6D8-661B03F6A1EF}\ "ButtonText" = "PokerStars" "Exec" = "C:\Programme\PokerStars\PokerStarsUpdate.exe" ["PokerStars"] {E2E2DD38-D088-4134-82B7-F2BA38496583}\ "MenuText" = "@xpsp3res.dll,-20001" "Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS] {E59EB121-F339-4851-A3BA-FE49C35617C2}\ "ButtonText" = "ICQ6" "MenuText" = "ICQ6" "Exec" = "C:\Programme\ICQ6\ICQ.exe" ["ICQ, Inc."] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <<H>> "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided) -> {HKLM...CLSID} = "Yahoo! Toolbar mit Pop-Up-Blocker" \InProcServer32\(Default) = "C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ BitDefender Communicator, XCOMM, ""C:\Programme\Gemeinsame Dateien\BitDefender\BitDefender Communicator\xcommsvr.exe" /service" ["BitDefender"] BitDefender Desktop Update Service, LIVESRV, ""C:\Programme\Gemeinsame Dateien\BitDefender\BitDefender Update Service\livesrv.exe" /service" ["BitDefender SRL"] BitDefender Threat Scanner, scan, "C:\WINDOWS\System32\svchost.exe -kbdx" {"C:\Programme\Gemeinsame Dateien\BitDefender\BitDefender Threat Scanner\scan.dll" ["S.C. BitDefender S.R.L"]} BitDefender Virus Shield, VSSERV, ""C:\Programme\BitDefender\BitDefender 2008\vsserv.exe" /service" ["BitDefender S.R.L."] Bluetooth Support Service, BthServ, "C:\WINDOWS\system32\svchost.exe -k bthsvcs" {"C:\WINDOWS\System32\bthserv.dll" [MS]} LexBce Server, LexBceS, "C:\WINDOWS\system32\LEXBCES.EXE" ["Lexmark International, Inc."] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] PLFlash DeviceIoControl Service, PLFlash DeviceIoControl Service, "C:\WINDOWS\system32\IoctlSvc.exe" ["Prolific Technology Inc."] SmartLinkService, SLService, "slserv.exe" [" "] StarWind AE Service, StarWindServiceAE, "C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe" ["Rocket Division Software"] TuneUp Designerweiterung, UxTuneUp, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\uxtuneup.dll" ["TuneUp Software GmbH"]} Windows Driver Foundation - User-mode Driver Framework, WudfSvc, "C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup" {"C:\WINDOWS\System32\WUDFSvc.dll" [MS]} Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ EPSON V6 2KMonitor\Driver = "EBPMON24.DLL" ["SEIKO EPSON CORPORATION"] Lexmark Network Port\Driver = "LEXLMPM.DLL" ["Lexmark International, Inc."] ---------- (launch time: 2008-06-30 17:08:25) <<!>>: Suspicious data at a malware launch point. <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 37 seconds, including 7 seconds for message boxes) ________________________________________________________________
__________________ Der schlimmste Virus ist der Mensch Ich dachte Trojaner haben was mit Sparta zu tun |
|
01.07.2008, 02:43
| #5 |
| | Habe versehentlich ein Videocodec angenommen, Virusbefall!!! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Header ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ find.bat Version 2008.03.07 Microsoft Windows XP [Version 5.1.2600] Bootmodus: Normal eScan Version: 9.9.2 Sprache: German C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\MWAV.LOG ~~~~~~~~~~~ Dateien ~~~~~~~~~~~ ~~~~ Infected files ~~~~~~~~~~~ ~~~~~~~~~~~ ~~~~ Tagged files ~~~~~~~~~~~ ~~~~~~~~~~~ ~~~~ Offending files ~~~~~~~~~~~ Offending file found: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ebay\ebay.url Offending file found: C:\WINDOWS\system32\unrar.dll ~~~~~~~~~~~ ~~~~ Spyware (Vorsicht: Oft Fehlalarm!) ~~~~~~~~~~~ MicroWorld AntiVirus und Antispyware Toolkit. C:\Programme\SUPERAntiSpyware, 30-Jun-2008 [Ordner] Antiviren- und Antispywaredatenbanken werden heruntergeladen... MicroWorld AntiVirus und Antispyware Toolkit. Scannen Spyware: Aktiviert ** {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} = C:\Programme\SUPERAntiSpyware\SASSEH.DLL ***** Registrierungsdatenbank und Dateisystem werden auf Schnüffelprogramme (Spyware) und werbefinanzierte Software (Adware) überprüft ***** Loading Spyware Signatures from new External Database [Name: C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\spydb.avs, Size: 829768]. Indexed Spyware Databases Successfully Created... System found infected with combo Spyware/Adware (HKEY_CLASSES_ROOT\clsid\{3c78b8e2-6c4d-11d1-ade2-0000f8754b99})! Action taken: Keine Maßnahme ergriffen. System found infected with parentis Spyware/Adware (HKEY_CLASSES_ROOT\clsid\{9bd3a001-42a2-491e-aaca-9512f6cf4cdb})! Action taken: Keine Maßnahme ergriffen. System found infected with parentis Spyware/Adware (HKEY_CLASSES_ROOT\clsid\{c5da1f2b-b2bf-4dfc-bc9a-439133543a67})! Action taken: Keine Maßnahme ergriffen. System found infected with parentis Spyware/Adware (HKEY_CLASSES_ROOT\clsid\{d2129738-6a78-4bcb-915a-412982caa23d})! Action taken: Keine Maßnahme ergriffen. System found infected with parentis Spyware/Adware (HKEY_CLASSES_ROOT\clsid\{dc90eaa6-69b8-4de4-9a7b-5b2c5b3feacd})! Action taken: Keine Maßnahme ergriffen. System found infected with parentis Spyware/Adware (HKEY_CLASSES_ROOT\interface\{1edfd7df-030d-4144-952e-9d7d86691cdb})! Action taken: Keine Maßnahme ergriffen. System found infected with parentis Spyware/Adware (HKEY_CLASSES_ROOT\interface\{459a91bc-193f-4a70-959c-bff69d781142})! Action taken: Keine Maßnahme ergriffen. System found infected with parentis Spyware/Adware (HKEY_CLASSES_ROOT\interface\{464d3e06-7d5b-416f-a6ee-0ffb1a5e931b})! Action taken: Keine Maßnahme ergriffen. System found infected with parentis Spyware/Adware (HKEY_CLASSES_ROOT\interface\{497b84d4-fb2f-4ab0-a280-8aacfb4b355f})! Action taken: Keine Maßnahme ergriffen. System found infected with parentis Spyware/Adware (HKEY_CLASSES_ROOT\interface\{66718b8e-a382-4fe2-aa7a-926f9d8c4621})! Action taken: Keine Maßnahme ergriffen. System found infected with parentis Spyware/Adware (HKEY_CLASSES_ROOT\interface\{bc39a57d-df2c-45b4-bffd-7d55e911c1b2})! Action taken: Keine Maßnahme ergriffen. System found infected with parentis Spyware/Adware (HKEY_CLASSES_ROOT\interface\{cca2e620-b807-451f-bafd-2057af9025fe})! Action taken: Keine Maßnahme ergriffen. Objekt "prutect Spyware/Adware" im Dateisystem gefunden! Maßnahme ergriffen: Keine Maßnahme ergriffen. Objekt "grokster Spyware/Adware" im Dateisystem gefunden! Maßnahme ergriffen: Keine Maßnahme ergriffen. System found infected with ezula Spyware/Adware (ebay.url)! Action taken: Keine Maßnahme ergriffen. System found infected with savenow Adware (C:\WINDOWS\system32\unrar.dll)! Action taken: Keine Maßnahme ergriffen. System found infected with backdoor (ircbot) trojans Spyware/Adware (hklm\software\microsoft\windows\currentversion\run/msconfig)! Action taken: Keine Maßnahme ergriffen. System found infected with combo Spyware/Adware (hklm\software\microsoft\windows\currentversion\run/alcmtr)! Action taken: Keine Maßnahme ergriffen. ~~~~~~~~~~~ Ordner ~~~~~~~~~~~ ~~~~~~~~~~~ Registry ~~~~~~~~~~~ Offending Key found: HKLM\Software\ptech !!! Offending Key found: HKCR\magnet !!! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Diverses ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~ laufende Prozesse - commandline ~~~~~~~~~~~~~~~~~~~~~~ System Idle Process - System - smss.exe - \SystemRoot\System32\smss.exe csrss.exe - winlogon.exe - winlogon.exe services.exe - C:\WINDOWS\system32\services.exe lsass.exe - C:\WINDOWS\system32\lsass.exe svchost.exe - C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe - svchost.exe - C:\WINDOWS\system32\svchost.exe -k netsvcs explorer.exe - C:\WINDOWS\Explorer.EXE firefox.exe - "C:\Programme\Mozilla Firefox\firefox.exe" notepad.exe - notepad.exe C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\MWAV.LOG cmd.exe - cmd /c ""C:\Dokumente und Einstellungen\Administrator\Desktop\find.bat" " cscript.exe - cscript C:\escan\prclst.vbs //nologo wmiprvse.exe - ~~~~~~~~~~~~~~~~~~~~~~ Scanfehler ~~~~~~~~~~~~~~~~~~~~~~ ERROR!!! Invalid Entry NBKeyScan = "C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" (in key SOFTWARE\Microsoft\Windows\CurrentVersion\Run). No Action Taken. ERROR!!! Invalid Entry NeroHomeFirstStart = "C:\Programme\Gemeinsame Dateien\Nero\Lib\NMFirstStart.exe" (in key SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce). No Action Taken. ERROR!!! Invalid Entry system32\DRIVERS\aswFsBlk.sys in SYSTEM\CurrentControlSet\Services\aswFsBlk. Action Taken: No Action Taken ERROR!!! Invalid Entry "C:\Programme\Gemeinsame Dateien\BOONTY Shared\Service\Boonty.exe" in SYSTEM\CurrentControlSet\Services\Boonty Games. Action Taken: No Action Taken ERROR!!! Invalid Entry \??\C:\DOKUME~1\*******~1\LOKALE~1\Temp\catchme.sys in SYSTEM\CurrentControlSet\Services\catchme. Action Taken: No Action Taken ERROR!!! ScanFile Fails for C:\WINDOWS\system32\Drivers\sptd.sys... ~~~~~~~~~~~~~~~~~~~~~~ Hosts-Datei ~~~~~~~~~~~~~~~~~~~~~~ DataBasePath: %SystemRoot%\System32\drivers\etc Zeilen die nicht dem Standard entsprechen: C:\WINDOWS\System32\drivers\etc\hosts: C:\WINDOWS\System32\drivers\etc\hosts:127.0.0.1 localhost ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Statistiken: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Zahl der gescannten Objekte: 59844 Zahl der kritischen Objekte: 18 Zahl der desinfizierten Objekte: 0 Zahl der umbenannten Dateien: 0 Zahl der gelöschten Objekte: 0 Zahl der Fehler: 53 Zeit verstrichen: 00:07:42 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan-Optionen ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Speicherüberprüfung: Aktiviert Registrierungsdatenbank-Überprüfung: Aktiviert Überprüfung des Startordners: Aktiviert Überprüfung des Systemordners: Aktiviert Überprüfung der Dienste: Aktiviert Option Überprüfung der Laufwerke deaktiviert Überprüfung der Ordner: Deaktiviert Batchstart: 3:21:16,78 Batchende: 3:21:19,06 ______________________________________________________________________________________________________________ Malwarebytes' Anti-Malware 1.09 Datenbank Version: 568 Scan Art: Komplett Scan (C:\|) Objekte gescannt: 76471 Scan Dauer: 32 minute(s), 56 second(s) Infizierte Speicher Prozesse: 0 Infizierte Speicher Module: 0 Infizierte Registrierungsschlüssel: 1 Infizierte Registrierungswerte: 1 Infizierte Datei Objekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 1 Infizierte Speicher Prozesse: (Keine Malware Objekte gefunden) Infizierte Speicher Module: (Keine Malware Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijack) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> Quarantined and deleted successfully. Infizierte Datei Objekte der Registrierung: (Keine Malware Objekte gefunden) Infizierte Verzeichnisse: (Keine Malware Objekte gefunden) Infizierte Dateien: C:\Dokumente und Einstellungen\*****\Desktop\Desktop\Bf2 crack\vtl-bf2k.exe (Trojan.Agent) -> Quarantined and deleted successfully.
__________________ Der schlimmste Virus ist der Mensch Ich dachte Trojaner haben was mit Sparta zu tun |
|
01.07.2008, 02:55
| #6 |
| | Habe versehentlich ein Videocodec angenommen, Virusbefall!!! Hallo Undoreal, dein Punkt 10. konnte ich nicht ausführen, da ich .zip dateien nicht als anhang schicken kann...
__________________ --> Habe versehentlich ein Videocodec angenommen, Virusbefall!!! |
|
01.07.2008, 11:28
| #7 |
| | Habe versehentlich ein Videocodec angenommen, Virusbefall!!!
__________________ Der schlimmste Virus ist der Mensch Ich dachte Trojaner haben was mit Sparta zu tun |
|
01.07.2008, 11:30
| #8 |
| /// AVZ-Toolkit Guru | Habe versehentlich ein Videocodec angenommen, Virusbefall!!! Hallöle. Also deine logs sind soweit sauber. Gibt es noch Probleme auf dem Rechner?
__________________ - Sämtliche Hilfestellungen im Forum werden ohne Gewährleistung oder Haftung gegeben - |
|
01.07.2008, 13:14
| #9 |
| |  Habe versehentlich ein Videocodec angenommen, Virusbefall!!! Bis jetzt sieht es ganz gut aus... Am Anfang hatte ich noch das Problem wenn ich Links öffnen wollte, das er alles mögliche geöffnet hat aber nicht das was ich wollte. Doch momentan läuft's Vielen lieben Dank
__________________ Der schlimmste Virus ist der Mensch Ich dachte Trojaner haben was mit Sparta zu tun |
|
01.07.2008, 13:21
| #10 |
| /// AVZ-Toolkit Guru | Habe versehentlich ein Videocodec angenommen, Virusbefall!!! Wenn du Auffälligkeiten bemerkst dann lasse es uns wissen. So ganz traue ich dem braten hier nämlich noch nicht.. Beobachte die nächsten Tage auch deinen Web-Traffic im Ruhezustand (also ohne das du mit irgendwelchen Programmen ins Internet gehest). Netzwerkmonitor 3.1
__________________ - Sämtliche Hilfestellungen im Forum werden ohne Gewährleistung oder Haftung gegeben - |
|
| Themen zu Habe versehentlich ein Videocodec angenommen, Virusbefall!!! |
| adobe, autorun, bho, defender, desktop, dll, einstellungen, explorer, firefox, google, hijack, hijackthis, hkus\s-1-5-18, internet, internet explorer, logfile, mozilla, mozilla firefox, nvidia, pdf, plug-in, pop-up-blocker, rundll, server, shortcut, software, system, tuneup.defrag, urlsearchhook, virus, windows, windows xp |
Linear-Darstellung
